PT-2025-11301 · Unknown · Sanitize-Html

Publicado 2025-03-14 · Atualizado 2025-03-14 · CVE-2025-29771

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: HtmlSanitizer versions prior to 2.0.3

Description: The issue is a cross-site scripting vulnerability that occurs when HtmlSanitizer is used with a contentEditable element to set the element's innerHTML to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier that runs after sanitation, it can lead to exploitation.

Recommendations: For versions prior to 2.0.3, update to version 2.0.3 to resolve the issue. As a temporary workaround, consider disabling the use of contentEditable elements with HtmlSanitizer until the update is applied. Restrict access to the code beautifier function to minimize the risk of exploitation. Avoid using the innerHTML property to set sanitized strings produced by HtmlSanitizer in contentEditable elements until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-29771

GHSA-VHV4-FH94-JM5X

Produtos afetados

Sanitize-Html

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29771.json · Exploit
• https://github.com/jitbit/HtmlSanitizer/security/advisories/GHSA-vhv4-fh94-jm5x · Nota
• https://github.com/jitbit/HtmlSanitizer/commit/af6d2a78877e7277cd01c825b7fb50edb5956963 · Nota
• https://github.com/jitbit/HtmlSanitizer · Nota
• https://t.me/cvedetector/20328 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-29771 · Nota de Segurança
• https://twitter.com/CVEnew/status/1900626159500406935 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-vhv4-fh94-jm5x · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-29771 · Aviso do Fabricante
• https://t.me/cvetracker/19156 · Publicação no Telegram